threat-intel Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot Researchers at Binarly discovered six new vulnerabilities in U-Boot, the firmware that starts up many hardware devices, including routers and servers. These flaws could allow attackers to execute malicious code at boot,… The Hacker News · Jul 10, 2026 High CVE-2026-33243firmwarebootloadervulnerability
threat-intel In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops Multiple cybersecurity incidents and threats are unfolding, including a ransomware affiliate pleading guilty in the US, a subscription-based remote access trojan (QuimaRAT) being actively sold on the dark web, and a Cana… SecurityWeek · Jul 10, 2026 High ARCAUSransomwaredata breachremote access trojan
vulnerability Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched Researchers at Ledger's Donjon security team have discovered a method to bypass the password protection on Tangem crypto wallet cards using a precisely timed laser pulse. The attack requires physical access to the card a… The Hacker News · Jul 10, 2026 High hardware walletlaser attackfirmware
threat-intel Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws Researchers have identified three security flaws in OpenClaw, an AI assistant, that could allow attackers to steal credentials, escalate privileges, and execute arbitrary code on the host system. These vulnerabilities ca… The Hacker News · Jul 10, 2026 High vulnerabilitysandboxcommand injection
threat-intel AI Coding: Do Security Risks Outweigh Productivity Gains? AI coding tools are rapidly increasing in popularity, with 91% of organizations using two or more and 54% using three or more. While developers report productivity gains and ROI, significant security risks are associated… Dark Reading · Jul 10, 2026 High aicodingsecurity
threat-intel Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites A cybercrime crew exposed its operations – including tools, logs, and target lists – after leaving a server open for three weeks. The WP-SHELLSTORM operation, which involved planting webshells on vulnerable WordPress and… The Hacker News · Jul 10, 2026 High CVE-2026-3844CVE-2021-29441CVE-2026-3300CHwebshellvulnerabilityexploit
threat-intel Attackers Exploit 'Ill Bloom' Vulnerability to Drain $3.1 Million From Cryptocurrency Wallets Attackers are exploiting a vulnerability called ‘Ill Bloom’ in several cryptocurrency wallets, allowing them to drain funds. A coordinated attack on May 27th resulted in $3.1 million being stolen from 431 wallets, with a… The Hacker News · Jul 10, 2026 High CVE-2023-39910CVE-2023-31290vulnerabilitycryptocurrencywallet
threat-intel ISC Stormcast For Friday, July 10th, 2026 https://isc.sans.edu/podcastdetail/10002, (Fri, Jul 10th) The ISC Stormcast highlighted a significant increase in malicious email campaigns targeting financial institutions, leveraging sophisticated phishing techniques and exploiting vulnerabilities in widely used communication… SANS Internet Storm Center · Jul 10, 2026 High phishingvulnerabilityslack
vulnerability Palo Alto Networks Patches 13 Vulnerabilities Palo Alto Networks has released advisories detailing 13 vulnerabilities across its products, including a critical buffer overflow that could lead to arbitrary code execution. While the company reports no active exploitat… SecurityWeek · Jul 9, 2026 High CVE-2026-0288vulnerabilitypatchbuffer overflow
data-breach 12 Million Impacted by Data Breach at Japanese Telco KDDI A data breach at Japanese telecom KDDI has impacted over 12 million users due to a zero-day vulnerability exploited by hackers. The attackers gained access to email addresses and passwords, prompting a company-wide passw… SecurityWeek · Jul 9, 2026 High JPdata breachzero-daypassword reset
vulnerability Schneider Electric PowerChute Serial Shutdown Schneider Electric PowerChute Serial Shutdown versions 1.4 and earlier contain multiple vulnerabilities that could allow attackers to overwrite critical files, inject malicious data, gain unauthorized access, or trigger… CISA Advisories · Jul 9, 2026 High CVE-2026-2399CVE-2026-2404CVE-2026-2405vulnerabilitypatchsecurity advisory
vulnerability OpenPLC v3 A critical vulnerability exists in OpenPLC v3, allowing authenticated attackers to write arbitrary files and escalate to arbitrary native code execution through the program upload process. This vulnerability affects crit… CISA Advisories · Jul 9, 2026 Critical CVE-2026-14480vulnerabilityindustrial control systemscwe-73
vulnerability 15-Year-Old Linux Vulnerability ‘GhostLock’ Earns Researchers $92k From Google A 15-year-old Linux kernel vulnerability, dubbed ‘GhostLock,’ has been exploited to earn a security researcher $92,000. The flaw allows for local privilege escalation and container escapes, highlighting the long-term ris… SecurityWeek · Jul 9, 2026 High CVE-2026-43499linuxkernelvulnerability
threat-intel The Language of AI Could Change How Humans Speak A joint statement from the Five Eyes intelligence alliance warns of rapidly increasing cyber risks stemming from the accelerating development of AI models. The core concern is that AI, particularly open-source models, is… Schneier on Security · Jul 9, 2026 High aicybersecurityhacking
threat-intel Summer of Clearinghouses The article discusses the recent surge in ‘clearinghouses’ – collections of pre-disclosure vulnerabilities – and argues that these are largely a distraction from the real issue: the speed at which vulnerabilities are dis… The Hacker News · Jul 9, 2026 High vulnerabilityopen sourceclearinghouse
vulnerability Microsoft Patches Defender ‘RoguePlanet’ Vulnerability Microsoft has released a patch to address a Defender vulnerability, dubbed RoguePlanet, which could allow an attacker to escalate privileges. The vulnerability was initially identified by Nightmare Eclipse (Chaotic Eclip… SecurityWeek · Jul 9, 2026 High CVE-2026-50656CVE-2026-41091CVE-2026-45498vulnerabilitypatchdefender
vulnerability AI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique AI coding assistants like Claude Code, Amazon Q Developer, and Cursor are vulnerable to a decades-old technique called GhostApproval, where attackers can trick the tools into accessing and modifying sensitive system file… SecurityWeek · Jul 9, 2026 High symlinkaicoding
vulnerability Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges Microsoft has patched a critical vulnerability, RoguePlanet, within its Defender antivirus software that could allow attackers to gain SYSTEM-level privileges. This flaw, discovered by Chaotic Eclipse, allows for arbitra… The Hacker News · Jul 9, 2026 Critical CVE-2026-50656CVE-2026-33825CVE-2026-45498vulnerabilityprivilege escalationantivirus
vulnerability Chrome 150 Update Patches 27 Vulnerabilities Google released Chrome 150, addressing 27 security vulnerabilities, including two critical flaws related to use-after-free bugs. The update represents a significant effort to remediate a substantial number of memory safe… SecurityWeek · Jul 9, 2026 Medium memory-safetyvulnerabilitychrome
threat-intel Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It Researchers at AI Now Institute have demonstrated a significant vulnerability in AI coding agents like Anthropic's Claude Code and OpenAI's Codex. By inserting a seemingly harmless binary disguised within a README file,… The Hacker News · Jul 9, 2026 High CVE-2026-39861aicode-injectionsecurity
